CVE-2026-53720 pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
Heap buffer overflow in pymonocypher's argon2i_32 allows attackers to corrupt memory and potentially execute code if a small buffer is provided.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53720?
CVE-2026-53720 is a medium-severity memory corruption vulnerability in jetperch pymonocypher, published on 3 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap. This issue has been patched in version 4.0.2.8.
Which versions are affected by CVE-2026-53720?
3 open source packages ship an affected version, including pymonocypher.
| Package | Affected | Fixed in |
|---|---|---|
pymonocypher PyPI | All versions | 4.0.2.8 |
pymonocypher PyPI | All versions | 4.0.2.8 |
pymonocypher PyPI | All versions | 4.0.2.8 |
How do I fix CVE-2026-53720?
Upgrade pymonocypher to 4.0.2.8 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53720 being exploited?
There is no known exploitation of CVE-2026-53720 in the wild and no public exploit code.
Sources
Also known as GHSA-8f95-v3jq-cj86, PYSEC-2026-3000.